polymarket

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can be ingested when the agent runs Polymarket actions that fetch market/event/account data from Polymarket’s public/authenticated web APIs (e.g., polymarket_search_markets_and_events, polymarket_get_market_by_slug, polymarket_list_events), where returned descriptions/titles are outsider-authored and become LLM-readable context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires running the CLI via "npx @useclawlink/cli", which fetches and executes remote code from the npm package (https://www.npmjs.com/package/@useclawlink/cli) / ClawLink (https://claw-link.dev) at runtime, so external content is downloaded and executed and is a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes trading and account-management actions for Polymarket via ClawLink, including polymarket_preview_order, polymarket_create_order (submit a new order), polymarket_cancel_order, polymarket_get_account_balances, polymarket_get_user_positions and related market/order endpoints. Those are specific market-order and account transaction capabilities (ability to place/cancel trades and view balances) — i.e., direct financial execution authority.